Auditing Quality Management in Aged Care: A Guide for Internal Auditors

Why Aged Care Quality Auditing Is Different

Aged care is one of the most scrutinised sectors in Australia. The Royal Commission into Aged Care Quality and Safety exposed systemic failures that shocked the public and prompted a complete overhaul of the regulatory framework. For internal auditors working in this sector, that context matters. You are not just checking conformity to a management system standard. You are auditing processes that directly affect the safety, dignity, and wellbeing of some of the most vulnerable people in the country.

This guide is written for internal auditors and quality managers working in residential aged care, home care, and short-term restorative care settings. It assumes you have a working knowledge of ISO 9001 and the Aged Care Quality Standards, and that you want practical guidance on how to conduct audits that are genuinely useful, not just compliant on paper.

If you are newer to internal auditing and want to understand the foundations before diving into sector-specific application, the step by step guide to becoming an ISO internal auditor is a good starting point.

The Regulatory Framework You Are Auditing Against

Before you plan a single audit activity, you need to understand what your audit criteria actually are. In aged care, this is layered.

The Aged Care Quality Standards

The Aged Care Quality Standards, administered by the Aged Care Quality and Safety Commission, are the primary benchmark for residential and home care providers. There are eight standards covering consumer dignity and choice, ongoing assessment and planning, personal care and clinical care, services and supports for daily living, organisation's service environment, feedback and complaints, human resources, and organisational governance.

These standards are outcome-focused. They ask whether consumers are experiencing the intended outcomes, not just whether procedures exist. This is a critical distinction for auditors. A documented care planning procedure means nothing if residents are not being involved in their own care decisions.

ISO 9001 and Its Role in Aged Care

Many aged care providers hold ISO 9001 certification or use it as the framework for their quality management system. ISO 9001 provides the structural backbone: context, leadership, planning, support, operations, performance evaluation, and improvement. The Aged Care Quality Standards sit on top of that structure as sector-specific requirements.

When you audit quality management in aged care, you are often auditing both simultaneously. Your audit criteria will reference ISO 9001 clauses and the corresponding Aged Care Quality Standards. Understanding how they map to each other will make your audits far more focused. The post on ISO 9001 for aged care providers covers this mapping in detail.

Other Regulatory Obligations

Aged care providers also operate under the Aged Care Act, the Serious Incident Response Scheme (SIRS), mandatory reporting obligations, and state-based work health and safety legislation. Your audit programme should account for compliance obligations across all of these, not just the quality standards.

Planning Your Aged Care Quality Audit

Risk-Based Audit Scheduling

Not all processes in an aged care organisation carry equal risk. Clinical care, medication management, incident reporting, and consumer feedback handling all carry higher inherent risk than, say, procurement of office supplies. Your audit programme should reflect this. Higher-risk processes warrant more frequent and more intensive audit attention.

When setting your annual audit schedule, consider the following risk factors: recent incidents or near misses, complaints received, previous nonconformities, staff turnover rates, new services or locations, and findings from the Aged Care Quality and Safety Commission's own assessment activities. If the Commission has recently raised concerns about a particular area, that area should be on your audit plan.

Defining Audit Scope and Objectives

Be specific about what each audit will cover. An audit of the care planning process is different from an audit of the complaints management process, even though both relate to consumer outcomes. Vague scope leads to vague findings.

For each audit, document what you are auditing, which standard clauses or requirements you are auditing against, what evidence you will seek, and what questions you intend to ask. This preparation is not bureaucratic overhead. It is what separates a productive audit from a tour of the facility.

Selecting and Briefing Your Audit Team

Internal auditors in aged care need a combination of auditing competence and sector knowledge. An auditor who does not understand the difference between a care plan and a progress note will struggle to assess whether clinical documentation is adequate. If your internal auditors lack clinical knowledge, consider pairing them with a clinical advisor or subject matter expert during the audit.

Auditor independence is non-negotiable. Auditors must not audit their own work. In smaller aged care organisations where staff wear multiple hats, this can be challenging. Document how you manage this, and be prepared to justify your approach if asked by the Commission or a certification body.

What to Audit: Key Processes and Evidence

Consumer Dignity, Choice, and Consent

Standard 1 of the Aged Care Quality Standards requires that consumers are treated with dignity and respect, and that their identity, culture, and diversity are valued. From an auditing perspective, this is one of the harder standards to assess because it is largely experiential.

Evidence to look for includes: records of consumer goals and preferences documented in care plans, evidence that consumers have been involved in decisions about their own care, consent records for personal care and medical interventions, and documentation of how cultural and language needs are identified and met.

Talk to staff about how they find out what matters to each resident. Talk to residents themselves where appropriate and where consent has been obtained. Observe interactions during care delivery if the audit scope allows for it. What you see and hear will often tell you more than any document.

Care Planning and Ongoing Assessment

Standard 2 requires ongoing assessment and planning with consumers. This is a high-volume documentation area and a common source of nonconformities.

When auditing care planning, check that assessments are current and reflect the resident's current condition, that care plans are individualised rather than templated, that changes in condition trigger a review of the care plan, and that the resident or their representative has been involved in the planning process. A care plan that has not been reviewed in six months for a resident whose health has changed significantly is a clear gap.

Sample across your resident cohort. Do not just pull the files that the facility manager selects. Ask for a random selection, or select files yourself based on length of stay, acuity level, or recent incidents.

Medication Management

Medication errors are a significant source of harm in aged care and a recurring theme in Commission findings. Your audit should examine whether medication administration records are complete and accurate, whether reconciliation processes are in place, whether staff who administer medications are competent and authorised to do so, and whether medication incidents are recorded and investigated.

Ask to see a sample of medication administration records alongside the medication charts. Look for gaps, corrections, and unexplained entries. Ask staff to walk you through what happens when a medication error occurs. The answer will tell you a great deal about the organisation's safety culture.

Incident Reporting and the Serious Incident Response Scheme

SIRS requires providers to report certain incidents to the Commission within defined timeframes. Priority 1 incidents must be reported within 24 hours. Your audit should verify that staff understand what constitutes a reportable incident, that incidents are being captured and classified correctly, that reports are submitted within the required timeframes, and that investigations are completed and lead to corrective action.

Pull a sample of incident records from the past six months. Cross-reference them with the SIRS register. Check whether any incidents that appear to meet the SIRS threshold were not reported. Unreported incidents are a serious nonconformity with regulatory consequences.

Complaints and Feedback

Standard 6 requires that providers have an effective system for receiving and acting on feedback and complaints. Audit the complaints register, check whether complaints have been acknowledged and resolved within documented timeframes, and look for evidence that complaint trends are being analysed and used to drive improvement.

One thing auditors often miss is the informal complaint. Not every concern raised by a resident or family member makes it into the formal complaints register. Ask staff how they handle a concern raised verbally at the nursing station. If the answer is that they deal with it on the spot and do not record it, that is worth exploring further.

Human Resources and Competence

Standard 7 requires that providers have a workforce that is sufficient, skilled, and supported. This maps directly to ISO 9001 Clause 7.2 on competence. Audit whether position descriptions exist and reflect actual duties, whether staff have the qualifications required for their roles, whether training records are current, whether mandatory training such as manual handling, infection control, and dementia care is completed and refreshed on schedule, and whether there is a process for assessing the ongoing competence of staff.

High staff turnover is common in aged care. Check whether orientation and induction processes are robust enough to bring new staff up to speed quickly. An agency nurse who has not been inducted to the facility's medication management procedures is a risk.

Organisational Governance

Standard 8 covers governance, including risk management, quality improvement, and financial management. From an ISO 9001 perspective, this maps to Clauses 4, 5, 6, 9, and 10. Audit whether there is an active risk register that is reviewed regularly, whether management review is conducted and documented, whether quality improvement activities are tracked and evaluated for effectiveness, and whether leadership is visibly engaged with quality outcomes.

Ask to see the most recent management review minutes. Check whether they address the mandatory inputs under ISO 9001 Clause 9.3, including audit results, customer satisfaction data, and the status of corrective actions. If management review is a rubber-stamp exercise conducted once a year with no meaningful discussion, that is a finding.

Common Nonconformities in Aged Care Quality Audits

Based on audit experience across the sector, the following nonconformities appear with regularity:

• Care plans not reviewed following a change in condition. The trigger for review is often not defined, or staff are not aware of it.
• Incident records that lack root cause analysis. The incident is recorded, but the investigation stops at what happened rather than why it happened.
• Competence records that are incomplete or out of date. Training is delivered but not recorded, or records are held in multiple systems with no reconciliation.
• Complaints not escalated appropriately. Informal complaints are resolved without being recorded, so trends are invisible to management.
• SIRS reporting timeframes not met. Often because staff are unsure whether an incident meets the threshold, and there is no clear escalation pathway.
• Consumer feedback not analysed for trends. Satisfaction surveys are collected but not systematically reviewed.

Writing Findings That Drive Improvement

An audit finding in aged care carries real weight. Write your nonconformities clearly, with a specific statement of the requirement, a description of the evidence or lack of evidence, and a factual account of what was observed. Avoid vague language like “some records were incomplete.” State how many records were reviewed, how many had the gap, and what the gap was.

Observations and opportunities for improvement should be written in a way that gives management something actionable to consider. In aged care, where the consequences of inaction can be serious, your report should make the risk visible without overstating it.

For detailed guidance on writing findings that hold up, the article on writing nonconformance reports that actually drive change covers the structure and language in practical terms.

After the Audit: Corrective Action and Follow-Up

Corrective action in aged care is not optional. If your audit identifies a gap in medication management or incident reporting, that gap needs to be closed. Assign clear ownership of each corrective action, set realistic timeframes, and schedule a follow-up review to verify that the action has been implemented and is effective.

Do not accept a corrective action that simply says the procedure has been updated. Ask how staff have been informed of the change, whether training has been delivered, and whether there is any evidence of the new behaviour in practice. Updating a document and changing practice are two very different things.

Building Your Competence as an Aged Care Quality Auditor

Auditing in aged care requires both auditing technique and sector knowledge. If you are building your auditing skills, formal training in ISO 9001 internal auditing gives you the methodological foundation: how to plan, conduct, report, and follow up an audit in a structured and evidence-based way. That foundation is then applied to the specific requirements of the aged care context.

Understanding how to gather evidence that stands up to scrutiny, how to interview staff without putting them on the defensive, and how to write findings that are clear and actionable are skills that transfer directly to aged care quality auditing.

Audit Workshop offers ISO 9001 Internal Auditor training that equips you with these practical skills. The training is delivered by an experienced lead auditor with real-world audit experience across multiple sectors, and it is available in both live and self-paced formats. If you are working in aged care quality and want to strengthen your internal audit capability, it is a practical investment in your professional development.

You may also find it useful to review the guide to auditing a healthcare quality management system, which covers similar principles in the broader healthcare context and addresses how to audit clinical processes without getting lost in clinical detail.